Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    23s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 08:05

General

  • Target

    3d213353948aba4d80c28823d8661951.exe

  • Size

    1.8MB

  • MD5

    3d213353948aba4d80c28823d8661951

  • SHA1

    8c7dadac2ee5f348a8940ab47187b39fd025bead

  • SHA256

    877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19

  • SHA512

    36ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1

  • SSDEEP

    24576:/r34Nhem94rOh31QzGpKHaHYSvvv22db+PowhGhomMJV4ynedX4QD/d5lBxdU7it:/I6g1AqY2v22pVfSJKyiXRd5lKu

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe
    "C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WjSZo78gzm.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:840
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2412
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          3⤵
            PID:2108
          • C:\Windows\PCHEALTH\csrss.exe
            "C:\Windows\PCHEALTH\csrss.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:572
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\DVD Maker\es-ES\lsass.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3016
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\es-ES\lsass.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2736
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\DVD Maker\es-ES\lsass.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2552
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\smss.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2248
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:328
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1032
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\PCHEALTH\csrss.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2812
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\csrss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2500
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\PCHEALTH\csrss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2180
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1252
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2956
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3056
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\sppsvc.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2300
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\sppsvc.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2940
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\sppsvc.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2396
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "3d213353948aba4d80c28823d86619513" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2944
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "3d213353948aba4d80c28823d8661951" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1812
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "3d213353948aba4d80c28823d86619513" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1796

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\DVD Maker\es-ES\lsass.exe

        Filesize

        1.8MB

        MD5

        3d213353948aba4d80c28823d8661951

        SHA1

        8c7dadac2ee5f348a8940ab47187b39fd025bead

        SHA256

        877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19

        SHA512

        36ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1

      • C:\Users\Admin\AppData\Local\Temp\WjSZo78gzm.bat

        Filesize

        205B

        MD5

        01fd79b7c35559c932b665886a3699bc

        SHA1

        61c92278278337fe47702ff92e46972db83eba01

        SHA256

        97d1a41765f709149921a0207f763c27d882287334fd1c0774aff8e10cc45dfc

        SHA512

        102068fc5463db991e340ed3c423bf9a44f2d0837bb8a98081d70f6513fe92208535f0ea17085bef5e3f5b784d95303d1062c72d7589e58a77b8dd528608a38d

      • memory/572-41-0x0000000001020000-0x00000000011FE000-memory.dmp

        Filesize

        1.9MB

      • memory/2808-6-0x0000000000380000-0x000000000038E000-memory.dmp

        Filesize

        56KB

      • memory/2808-16-0x0000000000390000-0x000000000039E000-memory.dmp

        Filesize

        56KB

      • memory/2808-0-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

        Filesize

        4KB

      • memory/2808-7-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-8-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-10-0x0000000000540000-0x000000000055C000-memory.dmp

        Filesize

        112KB

      • memory/2808-11-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-12-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

        Filesize

        4KB

      • memory/2808-17-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-4-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-18-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-14-0x0000000000560000-0x0000000000578000-memory.dmp

        Filesize

        96KB

      • memory/2808-3-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-30-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-31-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-2-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-37-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-38-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2808-1-0x0000000000AD0000-0x0000000000CAE000-memory.dmp

        Filesize

        1.9MB